Agent API

AI agents can discover, purchase, and evaluate EchoScan risk checks programmatically when the Agent Trial catalog reports available: true. Discovery stays available when purchasing is disabled, so a client must check the live product response before attempting payment.

EchoScan is a device identity and access-risk API. It is not a cryptocurrency product, and it does not ask a browser user to connect a wallet.

Discover the contract

Start with the machine-readable surfaces:

• /.well-known/api-catalog is the RFC 9727 API catalog.
• /openapi.json describes the Agent Trial and Lite Report endpoints.
• /llms.txt gives an agent a compact product and safety index.
• Human-readable API documentation covers Browser Verifier and Report API v1.

Responses also advertise the catalog with the api-catalog link relation. No MCP server or MCP Server Card is published in this release.

Check availability first

Call GET https://api.echoscan.org/api/v1/agent/products. Select agent_trial_lite_100 only when its available field is true, and treat the returned price, asset, network, duration, capabilities, and limits as the live contract.

This product’s exact capabilities are fingerprint.submit, fingerprint.report.lite, and agent.trial.status.

The public pages intentionally do not hard-code a production price or wallet address. A disabled or incomplete payment configuration must remain fail closed and report the product as unavailable.

Complete the Agent Trial flow

1. Create an intent with one exact HTTP or HTTPS origin, then retain its product, activate_url, and status_url fields.
2. Keep the one-time claim token only in process memory and send it as a Bearer credential.
3. Request the intent activation URL without payment and inspect the HTTP 402 PAYMENT-REQUIRED challenge.
4. Confirm the challenge still matches the locked quote, budget, network, asset, and pay-to address.
5. Use an x402 v2 exact-payment HTTP client to retry with PAYMENT-SIGNATURE.
6. Poll the status URL and retrieve the top-level trial_id, Environment ID, API key, allowed origin, quota, expiry, and report endpoint during the delivery window.
7. Run Browser Verifier from the exact allowed origin, send { imprint } to server-side code, and query the canonical Lite Report endpoint.

See the x402-compatible Agent Trial guide for retry, quota, expiry, and credential boundaries.

Keep secrets out of agent traces

Never put the buyer private key, claim token, PAYMENT-SIGNATURE, or EchoScan API key in a URL, prompt transcript, browser storage, log, metric label, or committed file. The Environment ID is publishable; the Agent Trial API key and payment credentials are not.

The trial key can retrieve Lite reports and its own trial status only. It cannot access Pro reasons, history, pick, submit-lite, billing, Console sessions, or internal routes.

Interpret a Lite report

Use risk.status as risk context for the customer’s own allow, challenge, review, or deny policy. Lite does not include Pro reasons or activity history, and EchoScan does not establish a person’s legal identity or intent.